A high-severity flaw in the Brotli decoder bundled with Node.js can corrupt process memory when an application decompresses attacker-controlled data. The impact can include a crash, memory disclosure, or remote code execution. Microsoft published Azure Web Application Firewall guidance on Oct 23; the Node.js project released fixed builds on Oct 21. Identify every affected runtime and patch it promptly.
Where the vulnerability reaches an application
CVE-2026-111497 is an out-of-bounds write in Brotli decoding. The Node.js project says malformed compressed input handled by node:zlib can write past an internal decoder buffer. An attacker needs a way to supply Brotli data that the vulnerable process will decompress; affected code may be in application logic or a dependency.
Microsoft's advisory covers Brotli versions 1.0.3 through 1.2.0 and lists fixed library releases 1.0.10, 1.1.1, and 1.2.1. Node.js applications should use the patched Node.js build for their release line, including when the vulnerable decoder is reached through Node's built-in compression APIs.
Use a fixed Node.js release
| Node.js release line | Fixed release | Action |
|---|---|---|
| 22.x | 22.23.4 | Upgrade the runtime and redeploy every service using this line. |
| 24.x | 24.22.1 | Upgrade the runtime and redeploy every service using this line. |
| 26.x | 26.12.1 | Upgrade the runtime and redeploy every service using this line. |
The Node.js project rates the issue high severity and says end-of-life release lines are affected when a security release occurs. If a vendor packages Node.js or Brotli for you, ask for the exact fixed package or image digest and the deployment date rather than relying on a broad statement that systems are patched.
Inventory decoding paths, including outbound fetches
- Find every Node.js runtime. Check server and container inventories, serverless functions, build agents, application platforms, and software vendors. Include long-running workers and less visible internal APIs.
- Trace Brotli decompression. Review software bills of materials and lockfiles, plus use of
node:zlib, request-body parsing, proxy middleware, and server-side fetches. Focus on data received from outside the trust boundary. - Patch and replace running processes. Update the Node.js base image or managed runtime, rebuild, redeploy, and restart workers. Updating a package on the host does not change a container image already in production.
- Verify the live version. Confirm the version inside each production process or container after rollout. Record the affected service, deployed image or runtime version, rollout time, and a successful health check.
- Close provider gaps. Ask hosting and software vendors whether their Node.js or Brotli runtime is fixed, whether the service has been restarted, and whether inbound or outbound decompression paths remain.
What Azure WAF can cover
Microsoft says Azure WAF with DRS 2.2 on Application Gateway or Azure Front Door Premium has a built-in check for restricted request headers. Rule 920450 is enabled at Paranoia Level 1 by default; when the policy is in Prevention mode, a match can block a request carrying the Brotli Content-Encoding header.
Older rule sets, a disabled or overridden rule, and Azure Front Door Standard may need a custom rule. Microsoft's published rule blocks requests whose Content-Encoding includes br. That can also reject legitimate clients that send Brotli-compressed request bodies. Start with logging, review real traffic, and test expected uploads and API calls before changing the action to block.
| Environment | Practical check |
|---|---|
| Application Gateway or Front Door Premium with DRS 2.2 | Confirm rule 920450 is enabled and the WAF policy uses Prevention mode. |
| Older ruleset, overridden rule, or Front Door Standard | Use Microsoft's product-specific custom rule guidance; begin in log-only mode and review false positives. |
| Apps that decode external responses | Patch the runtime. An inbound WAF rule does not inspect this traffic path. |
Microsoft notes that proof-of-concept payloads observed so far were about 23 MB, but smaller payloads may be possible. Request-size limits are an extra layer, not a standalone mitigation. Remove temporary WAF rules only after the application is patched or its managed ruleset provides the relevant protection.
Frequently asked questions
Which Node.js versions include the fix? The Node.js project lists 22.23.4, 24.22.1, and 26.12.1. Upgrade the release line your application runs and redeploy every process or container.
Is Azure WAF enough to close the issue? No. Azure WAF can help block selected inbound requests, but it cannot protect an application that decompresses attacker-controlled Brotli responses fetched from other servers. Patch the runtime.
Will blocking Content-Encoding br affect normal traffic? It can. Some clients legitimately send Brotli-compressed request bodies. Start with logging, inspect WAF logs, and test normal uploads and API requests before enabling a blocking rule.
Do request-size limits fix the vulnerability? No. Microsoft says observed proof-of-concept payloads were about 23 MB, but attackers may craft smaller payloads. Size limits are an additional control, not a substitute for patching.
Need help with the operational plan?
Accred Consulting helps organizations turn Microsoft security and infrastructure changes into a scoped implementation plan, with ownership and verification steps.
Plan a Security Review